Compliance Guides and Resources
Last updated: 22 October 2026
Practical, regularly updated guides from the Enactia team on governance, risk and compliance for cybersecurity and data protection. Start with the topic you are working on, or browse the frameworks and regulations the Enactia platform supports.
Getting started with GRC
Core guides if you are building or improving a governance, risk and compliance programme.
- What Is GRC? Governance, Risk and Compliance Explained
- Best GRC Software in 2026: How to Choose the Right Platform
- Spreadsheets vs GRC Software: When to Move Beyond Manual Compliance
- GRC Software by Framework: ISO 27001, SOC 2, ISO 27701, DORA and More
- OneTrust Alternatives: How to Choose the Right Privacy and GRC Platform
- Enactia vs Cynomi: Which vCISO Platform Fits Your MSP?
GRC and compliance by region
What applies where, with the regulators and laws to plan for.
- GRC and Compliance Software in Europe: Requirements by Country
- GRC Software for UK Organisations: UK GDPR, Cyber Resilience and Audit
- GRC Software for US Companies: SOC 2, HIPAA, SOX, NIST and State Privacy Laws
- GRC Software in Cyprus: GDPR, NIS2, CySEC and DORA Compliance
- GRC Software in the UAE and Saudi Arabia: PDPL, DIFC, NCA and SAMA
- NIS2 Country Transposition Tracker 2026: Status by Member State
Data protection and privacy
GDPR, UK GDPR and global privacy obligations for DPOs and privacy teams.
- GDPR Compliance Guide: A Step-by-Step Checklist for EU and UK Organisations
- UK GDPR vs EU GDPR: Key Differences for DPOs
- UK Data (Use and Access) Act 2025: What Changes and How to Comply
- GDPR ROPA Guide: Article 30 Records Explained
- GDPR Data Mapping: A Step-by-Step Guide for DPOs
- DPIA Under GDPR: When and How to Do One
- Understanding DSAR: A Complete Guide to Data Subject Access Requests
- DSAR Response Time: EU vs UK vs US Deadlines
- DSAR Identity Verification: A Proportionate Approach
- ICO Data Breach Reporting: A DPO's 72-Hour Guide
- Data Breach Response Plan Template for GDPR
- UK IDTA: International Data Transfer Agreement Guide
- US State Privacy Laws: A Compliance Guide for 2026
- KSA PDPL Compliance Guide 2026: Requirements, Fines & Checklist
- Bahrain PDPL Compliance Guide for Organisations
- Qatar PDPPL Compliance Guide for Organisations
- GDPR Cyprus 2026: Law 125(I) and Local Data Compliance
- EU Whistleblowing Directive: A Compliance Guide
NIS2 and cybersecurity
NIS2 scope, security measures, reporting and related cyber regulation.
- NIS2 Compliance Guide: 2026 Roadmap for EU Entities
- NIS2 Essential vs Important Entities: Scope Decision Guide
- NIS2 Article 21: The 10 Risk-Management Measures
- NIS2 Incident Reporting: 24h, 72h and 1-Month Cascade Guide
- NIS2 Registration: Requirements Under Articles 3 and 27
- NIS2 Supply Chain Security: Requirements and Checklist
- NIS2 Management Body Accountability: Article 20 Guide
- NIS2 Fines and Penalties: What Entities Risk
- NIS2 Compliance Checklist: 7 Steps for CISOs
- NIS2 vs DORA: Differences, Overlap and Which Applies
- NIS2 vs NIS1: What Changed and What It Means
- NIS2 to ISO 27001:2022 Mapping: Reuse 70% of Your ISMS
- UK Cyber Security and Resilience Bill: What It Means and How to Prepare
- NCSC CAF 4.0 Guide 2026: Automating Cyber Assessment Framework Outcomes
- EU Cyber Resilience Act (CRA) Compliance Solutions
- SEC Cybersecurity Disclosure Rules: Form 8-K Item 1.05 and 10-K Item 106 Guide
ISO 27001, SOC 2 and security frameworks
Certification and audit guides for security programmes.
- ISO 27001 Annex A Controls Explained: All 93 in 2026
- ISO 27001 Statement of Applicability Guide
- ISO 27001 Mandatory Documents: 2026 Checklist by Clause
- ISO 27001 Risk Treatment Plan: Template and Example
- ISO 27001 Internal Audit: Clause 9.2 Guide
- ISO 27001 Management Review: Clause 9.3 Guide
- ISO 27001 Certification Cost: What Drives the Price
- ISO 27001 Certification Timeline: Phases and Audits
- ISO 27005 Risk Assessment: A Practical Guide
- SOC 2 vs ISO 27001: Which Do You Need?
- Cyber Essentials vs ISO 27001: Which Do You Need?
- PCI DSS 4.0.1: A Practical Compliance Guide
- Mastering NIST CSF 2.0: The New Governance Tier
- HIPAA Security Risk Analysis: Step-by-Step Guide
- HIPAA Breach Notification Rule: Deadlines and Steps
- CMMC 2.0 Compliance Guide: Levels, Phases and 2026 Status
Financial services and operational resilience
DORA, UK operational resilience and sector supervision.
- Mastering DORA Compliance in 2026
- DORA ICT Risk Management Framework: CISO Guide 2026
- DORA Major Incident Reporting: Deadlines and Playbook
- DORA Register of Information: A Practical Guide
- UK Operational Resilience: FCA and PRA Requirements After March 2025
- CySEC Compliance 2026 | CIF Regulatory Reporting & DORA Strategy
- The Compliance Triple Threat: Mastering the Overlap Between DORA, NIS2, and the EU AI Act
Risk, third parties and governance
Risk registers, vendor risk and board-level governance.
- Third-Party Risk Management (TPRM): A Practical Guide and Lifecycle
- Vendor Risk Assessment Questionnaire: Question Bank
- Enterprise Risk Register Template: Fields and Examples
- Risk Appetite Statement: How to Write One (With Template)
- Risk Management Tools: Why Enactia is the Top GRC Choice
- UK Corporate Governance Code Provision 29: Internal Controls Declaration Guide
- German Supply Chain Act (LkSG) & CSDDD 2026 Updates
AI governance
The EU AI Act, ISO 42001 and governing autonomous AI.
- EU AI Act Compliance Guide: Requirements, Timeline and Checklist
- Agentic AI Governance: How to Manage and Audit Autonomous AI Risk
- ISO 42001 Certification: The 2026 Roadmap for AI Governance
- ICO AI Guidance 2026: A Practical Blueprint for UK Data Protection Officers
- Italy AI Law Compliance: Navigating Law 132/2025
For MSPs and consultancies
Running vCISO and vDPO services across many clients.
- Enactia for MSPs: Run a vCISO and vDPO Practice
- vCISO & vDPO Platform for MSPs: One Console, Every Client
- vCISO vs vDPO: Differences and Why Clients Need Both
- How to Start a vCISO Service: 7 Steps for MSPs
- vCISO Pricing Models for MSPs: How to Price Your Service
- vDPO as a Service: A Guide for MSPs and Consultancies
- NIS2 Services for MSPs: How to Package NIS2 for SMEs
- Multi-Tenant GRC Platform: What MSPs Should Look For
- White-Label GRC Platform Explained: A Guide for MSPs
- Best vCISO Platforms for MSPs in 2026: Compared
- Cynomi Alternatives for MSPs: 6 Options Compared
- Vanta Alternatives for MSPs: 5 Platforms Compared (2026)
- Apptega Alternatives for MSPs: 5 Platforms Compared
Frameworks and regulations we support
Each page explains the framework or law and how the Enactia platform helps you assess, evidence and maintain compliance with it. See the full frameworks and regulations overview.
- General Data Protection Regulation (GDPR)
- CCPA (California)
- Consumer Privacy Act of 2018 ('CPRA')
- EU Digital Operational Resilience Act (DORA)
- EU AI Act
- Network & Information Security Directive (NIS2)
- EU Cybersecurity Resilience Act
- ISO 27001
- ISO 27002
- ISO 27701
- ISO/IEC 27701:2019 – Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management
- ISO/IEC 27005
- ISO 42001 – Information Technology – Artificial Intelligence – Management System
- ISO 22301 – Business Continuity Management System
- ISO 9001:2015 (2021 Ed.1) – Quality Management System
- ISO 37301 (2021 ed.1) – Compliance Management Systems
- ISO 37001:2025 – Anti-bribery Management System
- ISO 37003:2025 – Fraud Control Management System
- SOC 2 (AICPA)
- PCI DSS
- NIST Cybersecurity Framework
- NIST Privacy Framework
- NIST SP 800-53 Rev. 5
- NIST SP 800-172
- Center for Internet Security (CIS) – Critical Security Controls – Version 8.1
- Cloud Control Matrix (CCM)
- Secure Controls Framework (SCF) 2022.2
- The Financial Services Sector Cybersecurity Profile (Profile) v1.0
- Microsoft SSPA
- EBA PSD2
- EBA ICT & Security Risk Management
- ENISA: Measures of Security of Personal Data Processing
- ENISA: Minimum Security Measures for Operators of Essential Services
- UK ICO Accountability Framework
- Controller's Data Protection Compliance (ICO) – United Kingdom (UK)
- Processor's Data Protection Compliance (ICO) – United Kingdom (UK)
- Health Insurance Portability and Accountability Act (HIPAA) – USA
- Personal Information Protection and Electronic Documents Act (PIPEDA) – Canada
- South African Protection of Personal Information Act (POPIA)
- Singapore Personal Data Protection Act (PDPA)
- Philippines Data Privacy Act (DPA)
- India Digital Personal Data Protection Bill (DPDP)
- Kingdom of Saudi Arabia (KSA) – Personal Data Protection Law (PDPL)
- Essential Cybersecurity Controls (ECC – 1 : 2018) – Kingdom of Saudi Arabia – National Cybersecurity Authority
- Critical Systems Cybersecurity Controls (CSCC – 1: 2019) – Kingdom of Saudi Arabia – National Cybersecurity Authority
- Saudi Arabian Monetary Authority (SAMA)
- UAE Federal Decree-Law No. 45 of 2021 ('PDPL')
- UAE Information Assurance Regulation – National Electronic Security Authority (NESA)
- DIFC Data Protection Law (UAE)
- Abu Dhabi Data Protection Regulation (ADGM DPR)
- Abu Dhabi Healthcare Information and Cyber Security Standard
- Bahrain Personal Data Protection Law (PDPL)
- World Lottery Association: WLA-SCS:2020 – WLA Security Control Standard
Free tools
Need help putting a framework into practice? Contact us or book a demo or start your 14-day free trial.
